We use a "Logon Batch file" that runs for all users when they login to the domain. It has a whole bunch of stuff in it, including a BUNCH of "ifmember statements" cascaded with "if not errorlevel ...